CVE-2017-8601

HIGH EXPLOITED IN THE WILD

Microsoft Edge - Remote Code Execution via JavaScript Engine Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2017-8601 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including Google Security Research.

AI-analyzed exploit summary This PoC exploits a type confusion vulnerability in Microsoft Edge's JavaScript engine by manipulating array and typed array objects. The exploit triggers a memory corruption issue by passing a crafted object to the 'func' function, leading to potential remote code execution.

Description

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8596, CVE-2017-8610, CVE-2017-8618, CVE-2017-8619, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8598 and CVE-2017-8609.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · htmldoswindows
https://www.exploit-db.com/exploits/42479

This PoC exploits a type confusion vulnerability in Microsoft Edge's JavaScript engine by manipulating array and typed array objects. The exploit triggers a memory corruption issue by passing a crafted object to the 'func' function, leading to potential remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Edge 40.15063.0.0 (Insider Preview)
No auth needed
Prerequisites: Target must be using a vulnerable version of Microsoft Edge · Attacker must deliver the exploit via a malicious webpage or script
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038849
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99420
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42479/

Scores

CVSS v3 7.5
EPSS 0.8119
EPSS Percentile 99.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2021-08-17
InTheWild.io 2021-08-17
CWE
CWE-119
Status published
Products (2)
microsoft/edge
Microsoft Corporation/Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Microsoft Edge
Published Jul 11, 2017
Tracked Since Feb 18, 2026